fix(e2e): revert portal/dev-session mock to flat ImpersonationSession

The API returns a flat ImpersonationSession object. CustomerPortal.tsx
reads s.id directly from the response. My previous fix incorrectly
wrapped the mock in { session: {...} }, causing s.id to be undefined
and setSession() to never fire.

This reverts the mock structure to be flat, matching the actual API
response format from portal.ts line 516.

apps/e2e/tests/impersonation.spec.ts

@@ -31,10 +31,21 @@ test.describe("ImpersonationBanner", () => {
     await page.route("**/api/impersonation/sessions/session-1/audit-log", (route) =>
       route.fulfill({ json: { logs: [] } })
     );
-    // Portal session endpoints needed when CustomerPortal fetches client profile after session is established
-    // FIX: nest session data under 'session' key so CustomerPortal.tsx can read data.session
+    // Portal session endpoint: CustomerPortal.tsx expects a FLAT ImpersonationSession object
     await page.route("POST **/api/portal/dev-session", (route) =>
-      route.fulfill({ json: { session: { id: "session-1", client: { id: "client-1", name: "Carol Client" } } } })
+      route.fulfill({
+        json: {
+          id: "session-1",
+          staffId: "staff-1",
+          clientId: "client-1",
+          reason: null,
+          status: "active",
+          startedAt: new Date().toISOString(),
+          endedAt: null,
+          expiresAt: new Date(Date.now() + 3600000).toISOString(),
+          createdAt: new Date().toISOString(),
+        },
+      })
     );
     await page.route("GET **/api/portal/me", (route) =>
       route.fulfill({ json: { id: "client-1", name: "Carol Client", email: "carol@test.com" } })